Operation Aurora DISCOVERED_BY Google
Google detected the attack activity in its network.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“Google detected this activity and realized they were dealing with an attack”
Episode
01 August 2018 Official episode · Official transcript
advanced persistent threat
The episode describes Operation Aurora, a coordinated cyber-espionage campaign that compromised Google and numerous other companies using targeted phishing, zero-day exploits, a Trojan, and access to source-code repositories. Researchers associated the activity with the Elderwood group and suspected links to China.
Topics: Operation Aurora cyber-espionage campaign, targeted phishing and email spoofing, zero-day exploitation, Internet Explorer exploitation, Trojan malware and antivirus evasion, command-and-control traffic disguised as web traffic, source-code repository security, Perforce insecure defaults, watering-hole attacks, supply-chain compromise, cyber-enabled intellectual-property theft, commercial-sector cyber espionage, defense-contractor targeting
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
Operation Aurora DISCOVERED_BY Google
Google detected the attack activity in its network.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“Google detected this activity and realized they were dealing with an attack”
Operation Aurora COMPROMISES Google
The attackers compromised numerous Google systems and burrowed into Google’s servers.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“They compromised numerous systems and burrowed their way deep into Google’s servers”
Operation Aurora COMPROMISES Adobe
Adobe said it had also been hacked during the winter holidays.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“Adobe admitted that they too, got hacked over the winter holidays”
Operation Aurora COMPROMISES Yahoo
Yahoo was among the companies hit by the attack.
Explicit Confidence 97% · Jack Rhysider EP 19 Details
“Yahoo, Rackspace, Microsoft, Juniper Networks, and Dow Chemicals”
Operation Aurora COMPROMISES Rackspace
Rackspace was among the companies hit by the attack.
Explicit Confidence 97% · Jack Rhysider EP 19 Details
“Yahoo, Rackspace, Microsoft, Juniper Networks, and Dow Chemicals”
Operation Aurora COMPROMISES Microsoft
Microsoft was among the companies hit by the attack.
Explicit Confidence 97% · Jack Rhysider EP 19 Details
“Yahoo, Rackspace, Microsoft, Juniper Networks, and Dow Chemicals”
Operation Aurora COMPROMISES Juniper Networks
Juniper Networks was among the companies hit by the attack.
Explicit Confidence 97% · Jack Rhysider EP 19 Details
“Yahoo, Rackspace, Microsoft, Juniper Networks, and Dow Chemicals”
Operation Aurora COMPROMISES Dow Chemicals
Dow Chemicals was among the companies hit by the attack.
Explicit Confidence 97% · Jack Rhysider EP 19 Details
“Yahoo, Rackspace, Microsoft, Juniper Networks, and Dow Chemicals”
Operation Aurora INVOLVES phishing
The attackers researched targets and sent carefully spoofed phishing emails.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“Then they would send a phishing e-mail to the target”
Operation Aurora INITIAL_ACCESS_VIA phishing
The described initial access method was a targeted phishing email containing a link.
Explicit Confidence 98% · Jack Rhysider EP 19 Details
“The hackers knew who that person would e-mail normally and what those e-mails would look like so the hacker spoofed an e-mail”
Operation Aurora INVOLVES zero-day exploit
The attack used a zero-day exploit that worked against a fully patched Internet Explorer.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“It was using what’s known as a zero-day exploit”
zero-day exploit EXPLOITS Internet Explorer vulnerability
The zero-day exploit exploited an Internet Explorer vulnerability unknown to Microsoft at the time.
Derived Confidence 96% · Jack Rhysider EP 19 Details
“The malware was not known by Microsoft so it was still able to exploit a fully-patched internet explorer”
Internet Explorer vulnerability AFFECTS Internet Explorer
The vulnerability affected Internet Explorer.
Explicit Confidence 94% · Jack Rhysider EP 19 Details
“a fully-patched internet explorer”
Operation Aurora INVOLVES Trojan
The attack downloaded and ran a newly made Trojan on victims’ computers.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“the program that was downloaded and ran was a Trojan”
Trojan USES command and control tunnel
The Trojan opened a tunnel back to the attackers to control the victim’s computer, disguised as regular web traffic.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“This Trojan opened up a tunnel back to the hackers so they could control the victim’s computer”
Operation Aurora INVOLVES Google source-code repositories
The attackers accessed Google’s source-code repositories and took some Google source code.
Explicit Confidence 98% · Jack Rhysider EP 19 Details
“they were able to easily access Perforce and take some of the source code from Google”
Operation Aurora INVOLVES Perforce
Google stored its source code in Perforce, which the attackers entered using an unknown bug.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“The attackers knew exactly where the Perforce servers were and used yet another unknown bug to get into Perforce”
Operation Aurora COMPROMISES Google source-code repositories
The attackers compromised or accessed Google’s source-code repository environment.
Explicit Confidence 95% · Jack Rhysider EP 19 Details
“take some of the source code from Google, possibly the source code for the Chrome browser”
Operation Aurora ATTRIBUTED_TO China
Google believed the campaign originated in China; this attribution was presented by Hillary Clinton as an allegation under investigation.
Attributed Confidence 90% · Hillary Clinton EP 19 Details
“a campaign that the company believes originated in China”
Operation Aurora ASSOCIATED_WITH Elderwood
Security researchers associated the attack with the group later called Elderwood; Symantec derived the name from a variable in the malware code.
Attributed Confidence 94% · Jack Rhysider EP 19 Details
“When Symantec investigated the malware further they found the code frequently used a variable with the name Elderwood so they called this hacking group Elderwood”
Elderwood USES zero-day exploit
Elderwood was reported to use multiple zero-day exploits in later attack campaigns.
Attributed Confidence 93% · Jack Rhysider EP 19 Details
“In fact, they had five different zero-day exploits for Adobe Flash”
zero-day exploit EXPLOITS Adobe Flash vulnerability
The later zero-day exploits used by the suspected Elderwood group targeted Adobe Flash vulnerabilities.
Explicit Confidence 96% · Jack Rhysider EP 19 Details
“The next attack they conducted after Operation Aurora contained a zero-day exploit using Adobe Flash”
Elderwood USES watering-hole attack
After Operation Aurora, Elderwood changed its initial-entry tactic to watering-hole attacks.
Attributed Confidence 95% · Jack Rhysider EP 19 Details
“Instead of getting people to click the phishing e-mail they used what’s known as a watering-hole attack”
Elderwood TARGETS Lockheed Martin
Elderwood appeared to be primarily interested in gaining access to defense companies including Lockheed Martin.
Uncertain Confidence 88% · Jack Rhysider EP 19 Details
“They seem to be mostly interested in gaining access to defense companies, companies like Lockheed Martin”
Elderwood appeared to be primarily interested in gaining access to defense companies including Raytheon.
Uncertain Confidence 88% · Jack Rhysider EP 19 Details
“companies like Lockheed Martin, Raytheon, Boeing, and General Dynamics”
Elderwood appeared to be primarily interested in gaining access to defense companies including Boeing.
Uncertain Confidence 88% · Jack Rhysider EP 19 Details
“companies like Lockheed Martin, Raytheon, Boeing, and General Dynamics”
Elderwood TARGETS General Dynamics
Elderwood appeared to be primarily interested in gaining access to defense companies including General Dynamics.
Uncertain Confidence 88% · Jack Rhysider EP 19 Details
“companies like Lockheed Martin, Raytheon, Boeing, and General Dynamics”
Elderwood USES supply-chain compromise
Elderwood was described as compromising suppliers and third parties so malicious software could reach defense contractors through the supply chain.
Explicit Confidence 98% · Jack Rhysider EP 19 Details
“if they can infect the supply chain and that software gets into the defense company, then it’s just as good as hacking into the defense company”
Elderwood TARGETS Amnesty International Hong Kong
The same group that was suspected of conducting Operation Aurora was also suspected of placing zero-day Flash exploits on Amnesty International Hong Kong’s website.
Uncertain Confidence 88% · Jack Rhysider EP 19 Details
“It’s suspected that the same group that did Operation Aurora in 2010 were also responsible for placing zero-day Flash exploits on the website for Amnesty International Hong Kong”
Operation Aurora INVOLVES McAfee
McAfee obtained and reverse-engineered the malware used in the attack and named the operation after its Aurora folder.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“When McAfee reverse-engineered the malware they found that when the hacker executed the attack they ran it out of a folder called Aurora”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T04:14:52.486896+00:00